Privacy policy

Information we process

For public scans, we process the submitted website URL, public content retrieved from that website, technical request logs, questionnaire responses, and the email address supplied to unlock a report.

For an authorized active product test, we may also process the exact test prompt and response, generated files, screenshots, timestamps, product URLs, technical metadata, provenance results, and a recorded browser replay. Account setup is performed in a processor-hosted browser session: credentials are entered directly into the tested product and are not collected by Evidently.

How we use information

We use this information to run the requested assessment, produce and deliver its report, compare authorized reruns, protect the service from abuse, diagnose failures, and improve detection quality. We do not sell personal information or use report email addresses for unrelated advertising.

Browserbase processes hosted browser sessions and replay data. Our hosting, database, and object-storage providers process the evidence needed to operate the service. Active tests do not retain HAR files or full network logs by default because they may contain tokens or private prompts.

Retention and security

Public scan records and report leads are retained for up to 90 days unless a customer asks us to retain an evidence record for longer. Active-test files and browser evidence are retained for up to 30 days by default, unless a customer selects a different evidence period or legal/security needs require limited preservation. Signed evidence links expire much sooner.

Access is limited to authorized personnel and processors. Authentication sessions are not recorded; test sessions are recorded for evidence. Product passwords and API secrets must not be placed in prompts, target URLs, notes, or report fields.

Your choices

You may request access, correction, or deletion of personal information associated with a report by contacting lennon@evidently.co. We may need to verify the request and preserve limited records where law or security requires it.